Tagged Questions

2
votes
2answers
71 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
2
votes
1answer
158 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
3
votes
1answer
111 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
4
votes
1answer
272 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
1answer
174 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
0
votes
1answer
156 views

Free OCSP server

I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300. Are there any open source products that could act as ...
1
vote
1answer
766 views

RDP Certificate Distribution Points

I am receiving the message "Your computer can't connect to the remote computer because the Remote Desktop Gateway's server's certificate has expired or has been revoked" when trying to access a TS ...
2
votes
1answer
609 views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
1
vote
1answer
369 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
0
votes
1answer
99 views

Use Certificate Autoenrolment with third-party Certificate Authority

Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority? We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
1
vote
1answer
108 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...